1997 F-Body ECM

**Tom H** · 01-18-2020

I got a bit carried away using the bootstrap mode and got a bit off topic. Still, it's worth posting some of what I found out to the list. I wanted to get more sure of my setup before going after the TPU. I needed to make sure all the assembler switches were well understood and try a few test cases.

One easy target is the Port Replacement Unit with RAM (PRU) used on my boards. It is marked with GM house numbers:

65146C91
66285
466

The main features of this part are:

2K (less a few) RAM
Four channels of Pulse
Four ports of I/O
Watchdog timer

I wrote a simple RAM test for addresses $1810 through $1FFF. Then I wrote programs to toggle each bit of the first 3 ports. The device can be configured for input or output. I did not output on lines used as inputs to prevent contention. The last I/O port is open drain, thus needing no direction settings. I found the lower four bits. Still missing from my understanding are four pins and four register bits. Some day, a bit more work here...

The PWM section is interesting. The lower byte configures the pulse width in 1/256 increments. That I had figured would be the case. The upper byte of the PWM config was not known to me, so I wrote a routine to manipulate it. Turns out that the PWM section is driven by Eclock divided by 2. The upper byte scales this and affects the rep rate of the pwm. The lower the number the faster the rep rate. I guess this was done to tune the response of things like egr. Electro magnetic radiation may also come into it...run things as slow as you can. If trying to filter and create an analog you might want to run it fast. In any case, I have a couple of attachments. First is an excel table of pwm config upper byte vs repetition rate. Second is the pinout of the PRU.

If anyone can help with the missing pins/register bits, please post. The pins are connected to the ribbon cable and to a unknown chip:

609-3700521
CP08978
144436
9638N

Any and all details of that chip are of great interest.

-Tom

**kur4o** · 01-19-2020

609-3700521
CP08978
144436
9638N

94-95 has the very same chip. Visual comparison shows some similarities with the injector driver chip but smaller. Both are marked NCR. SO it could be some driver chip??Ignition coil driver??.

I was sure the first byte of the PWM output is some frequency but never have the time to measure it. Gm uses some fix value there. The second byte is 0-ff and ff is on all the time, it is used on the fuel pump output. It also can be interpreted like this. First byte is off time[Lower is shorter]. Second byte is ON time. On and Off times are scaled by the frequency of the CPU.

I compared some random memory range between 94-95 and 96-97 code and it looks like they are set identically.

Code:

RESERVED:1800 byte_1800:      fcb 1                   ; DATA XREF: __RESET-4B0Dw
RESERVED:1800                                         ; __RESET-4B09w ...
RESERVED:1800                                         ; HARDWARE CONTROL WORD
RESERVED:1800                                         ; load $40 at reset than cleared at reset
RESERVED:1800                                         ;
RESERVED:1800                                         ; $01 1=PIN B9 energize
RESERVED:1800                                         ;     1= byte_2f $02 = 1
RESERVED:1800                                         ;     1=set from TSIDE on some system error ad volt<4V with fan 1 and 2
RESERVED:1800                                         ;     1= ENGINE OFF SERVICE FIELD GROUNDED
RESERVED:1800                                         ;     1=byte_82 $08 set
RESERVED:1800                                         ; $02 1=AIR PUMP relay ON; OFF IF VOLTAGE > 17.1
RESERVED:1800                                         ; $04 1= OIL LEVEL LAMP ON
RESERVED:1800                                         ;     1=Byte_27 $80 = 1 SET BY 1804 $20
RESERVED:1800                                         ; $08 1=byte_2e $40 = 1 $40 AT shift sol rel b0
RESERVED:1800                                         ; $10 1=byte_2e $80 = 1 $80 ATshift sol rel b1
RESERVED:1800                                         ; $40 1=???some rel???
RESERVED:1801 byte_1801:      fcb $FF                 ; DATA XREF: __RESET-4B1Bw
RESERVED:1801                                         ; SOL_PLUS_OTHERsub_48E7+18Cw
RESERVED:1801                                         ; Load FF at reset
RESERVED:1802 byte_1802:      fcb $9C                 ; DATA XREF: __RESET-4B04w
RESERVED:1802                                         ; OC4I+9Ar ...
RESERVED:1802                                         ; load $04 at reset
RESERVED:1802                                         ;
RESERVED:1802                                         ; $01 1=FAN 1 ON
RESERVED:1802                                         ; $02 1=FAN 2 ON
RESERVED:1802                                         ; $04 1=always set
RESERVED:1802                                         ; $08 1= INJECTOR FAULT
RESERVED:1802                                         ; $10 1=PIN 24 B+
RESERVED:1802                                         ;     0=PIN 24 grounded
RESERVED:1803 byte_1803:      fcb 7                   ; DATA XREF: __RESET-4B16w
RESERVED:1803                                         ; SOL_PLUS_OTHERsub_48E7+18Fr ...
RESERVED:1803                                         ; Load $03 at reset
RESERVED:1804 byte_1804:      fcb $FC                 ; DATA XREF: OC4I+A0r
RESERVED:1804                                         ; SPIEsub_6EF6r ...
RESERVED:1804                                         ; HARDWARE STATUS WORD
RESERVED:1804                                         ;
RESERVED:1804                                         ; $01 1=?? BYTE_33 $04
RESERVED:1804                                         ; $02 1=?? BYTE_33 $08
RESERVED:1804                                         ; $04=1 set byte_35 $20 ??POWER STEERING SWITCH??
RESERVED:1804                                         ; $08 1=??
RESERVED:1804                                         ; $20 1=??
RESERVED:1804                                         ; $10 1=???+
RESERVED:1804                                         ; $40 0=CRUISE ACTIVE OR TCC TEMP SWITCH
RESERVED:1804                                         ;
RESERVED:1804                                         ; tside INFO
RESERVED:1804                                         ; $01 1=AC REQUEST
RESERVED:1804                                         ; $02 1=AC CLUTCH STATUS ON
RESERVED:1804                                         ; $04 1=POWER STEERING REQUST
RESERVED:1804                                         ; $08 1=HEATED WINDSHIELD REQUEST pin B25
RESERVED:1804                                         ; $10 1=OIL CHANGE RESET SWITCH pin B18
RESERVED:1804                                         ; $20 1=OIL LEVEL SWITCH
RESERVED:1804                                         ; $40 1=CRUISE CONTROL request pin B22
RESERVED:1804                                         ; $80 1=pin B23
RESERVED:1805 byte_1805:      fcb 0                   ; DATA XREF: __RESET-4B12w
RESERVED:1805                                         ; SOL_PLUS_OTHERsub_48E7+198w
RESERVED:1805                                         ; cleared at reset
RESERVED:1806 byte_1806:      fcb $D1                 ; DATA XREF: __RESET-4AB1w
RESERVED:1806                                         ; __RESET-4AAEw ...
RESERVED:1807 byte_1807:      fcb 3                   ; DATA XREF: __RESET-4AFFw
RESERVED:1807                                         ; SOL_PLUS_OTHERsub_48E7+E6r ...
RESERVED:1807                                         ; load $03 at reset
RESERVED:1807                                         ; ??POSS FUEL PUMP ?? semi engaged at ign on once
RESERVED:1808 word_1808:      fdb $BF00               ; DATA XREF: SOL_PLUS_OTHERsub_48E7+1Bw
RESERVED:1808                                         ; sub_7CFE+1D6w
RESERVED:1808                                         ; PWM DC% CHANNEL 1
RESERVED:1808                                         ;
RESERVED:1808                                         ; $BF + $ EGR DC%
RESERVED:180A word_180A:      fdb $2FE6               ; DATA XREF: __RESET-48D3w
RESERVED:180A                                         ; RTII:loc_514Aw ...
RESERVED:180A                                         ; PWM DC% CHANNEL 2 ??PIN A12 output??
RESERVED:180A                                         ; at reset and RTII loaded from calc tps=b and 2f=a ??TRACTION TPS SEND??
RESERVED:180A                                         ; at sub_7cfe  loaded with bf9a
RESERVED:180A                                         ;
RESERVED:180A                                         ; ADR#0 CALC VALUE AD_voltage
RESERVED:180A                                         ; loaded with $2700 from ad_voltage if B+<17.7V
RESERVED:180A                                         ; if B+>17.1V loaded from ad value + calculations
RESERVED:180A                                         ;
RESERVED:180A                                         ; ??HARD CONTROL WORD?? 2F00 or 2F?? if B+>17.1V
RESERVED:180C word_180C:      fdb $BF00               ; DATA XREF: __RESET-4AF9w
RESERVED:180C                                         ; SOL_PLUS_OTHERsub_48E7:loc_4932w ...
RESERVED:180C                                         ; PWM DC% CHANNEL 3 FUEL PUMP relay
RESERVED:180C                                         ;
RESERVED:180C                                         ; Load bfff at reset
RESERVED:180C                                         ; Load 2f4c at sub_7cfe
RESERVED:180C                                         ;
RESERVED:180C                                         ; BF00 if BYTE_2e $20 =1
RESERVED:180C                                         ; BFFF if BYTE_2e $20 =0
RESERVED:180E word_180E:      fdb $5100               ; DATA XREF: SOL_PLUS_OTHERsub_48E7+13w
RESERVED:180E                                         ; sub_7CFE+1E8w
RESERVED:180E                                         ; PWM DC% CHANNEL 4
RESERVED:180E                                         ;
RESERVED:180E                                         ; $51 + $3-2 DC

FSR:1000 PORTA:          fcb 8                   ; DATA XREF: __RESET-4B4Bw
FSR:1000                                         ; OC4I+A6r ...
FSR:1000                                         ; $20 1=Performance pattern requested
FSR:1000                                         ; $40 1=(DRIVE 2)some Auto pattern requested


FSR:1031 ADR1:           fcb $1D                 ; DATA XREF: __RESET-49F7r
FSR:1031                                         ; __RESET-49E8r ...
FSR:1031                                         ; 7 byte_12f - EST AD Voltage
FSR:1031                                         ; 6 byte_12e
FSR:1031                                         ; 5 coolant temp
FSR:1031                                         ;   -byte_12d raw;
FSR:1031                                         ;   -byte_1d9 byte_192 filtered with 7fee
FSR:1031                                         ; 4 Intake temp
FSR:1031                                         ;   -byte_12c raw
FSR:1031                                         ;   -byte_1d8 filtered with 80ee
FSR:1031                                         ; 3 tps voltage
FSR:1031                                         ; 2 map voltage
FSR:1031                                         ; 1 byte_129 some AD voltage
FSR:1031                                         ; 0 byte_128 IGN AD Voltage

**Tom H** · 01-19-2020

Originally Posted by kur4o

94-95 has the very same chip. Visual comparison shows some similarities with the injector driver chip but smaller. Both are marked NCR. SO it could be some driver chip??Ignition coil driver??.

I think this is related to the ignition circuit. Traced half of the lines. On my target board, both the injector driver and this chip are marked "Symbios logic". I would like to document some of what I am doing and post. The 144436 chip drives (receives??) from one of the staggered single inline packs up on the aluminum heat spreader. I think earlier you had a board with these parts removed. Can you give me the house numbers for the SIPs? I intend to refer to them as marked.
SIP_RB_CS.jpg

Originally Posted by kur4o

I was sure the first byte of the PWM output is some frequency but never have the time to measure it. Gm uses some fix value there. The second byte is 0-ff and ff is on all the time, it is used on the fuel pump output. It also can be interpreted like this. First byte is off time[Lower is shorter]. Second byte is ON time. On and Off times are scaled by the frequency of the CPU.

First byte sets the clock rate/rep rate of the PWM. Second byte sets the pulse width in increments of 1/256.

My first try with the TPU will be to see if I can configure it such that I can read VATS outside the GM program. This is a good test because I *think* I know which words of the microcode relate to it. Perhaps I can try to change the place where the transition count is stored, that way I can prove the function of one of the fields. If I can, it's a small victory, but could potentially unlock the tpu. Time will tell.

-Tom

**dzidaV8** · 01-19-2020

Here are my findings from the time I was reverse engineering the boards of LT1:

[disregard the TPU address mapping, it was done assuming the TPU was another HC11]

**Tom H** · 01-19-2020

Thank you dzidaV8. What I am looking for is the printing on the chips for identification. I have a 99.9% match with the info you sent.

Cheers,
Tom

**kur4o** · 01-20-2020

I have the numbers from different boards that looks similar or analog to the ones you have.

Sip2 and SIp3 can be one of these
014
m33al
41398
or
Motorola
16180566
QPD32B

Sip4 is the voltage regulator. On 94 board is marked
70306
466 33738985

The 23 pin SIPs are quad driver chips. They are on almost any gm pcm from 90-on.
I have a marking from one from 96 gm board.
185
16166240
YYEK9546.

I think that you can lift the chips a little to read the marking . The pins are flexible enough to withstand 2-3mm lift.

On my pcm I have burned the 5v output on the voltage regulator and managed to find a replacement on ali express, so these must be some standard quaddrivers.

**Tom H** · 01-20-2020

Thank you kur4o, I will put the info into the schematic.

I came across a few functions that will be of interest. A bunch of posts back, I tried to list all the expected functions of TPU. I missed tach output and speedo outputs. Here are the pins on the tpu

4 RED CONNECTOR SIP PIN 19 "OUT 3 CONTROL": OUT 3 ENGINE SPEED OUT
5 BLACK CONNECTOR SIP PIN 5 "OUT 2 CONTROL": OUT 2 DRIVES VSS OUT
6 RED CONNECTOR THROUGH NETWORK OF R/C/DIODE/COMPARATOR: DRIVEN BY VSS IN

-Tom